domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

raven

Raven C2 externo de CobaltStrike para Websockets Información adicional: https://www.cobaltstrike.com/help-externalc2 Compilación del servidor Ubuntu Copia la carpeta del servidor a tu VPS. Ejecuta ./setup.sh como root o con sudo. Compilación del cliente Windows Copia la carpeta del cliente a un...

WSC2

WSC2 ÚLTIMA/VERSIÓN ACTUAL: 0.1 Autor: Arno0x0x - @Arno0x0x WSC2 es una Prueba de Concepto PoC del uso de WebSockets y un proceso de navegador para servir como canal de comunicación C2 entre un agente, ejecutándose en el sistema objetivo, y un controlador que actúa como el servidor C2 real. La...

sonar.js

sonar.js A framework for identifying and launching exploits against internal network hosts. Works via WebRTC IP enumeration, WebSocket host scanning, and external resource fingerprinting. How does it work? Upon loading the sonar.js payload in a modern web browser the following will happen: sonar....

pyFlipper

PyFlipper Envoltorio CLI de Python para Flipper Zero Artículos Cómo hackear un restaurante Funciones y características: Envoltorio CLI serie para Flipper Interfaz de cliente WebSocket Interfaz TCP simple Novedades compatibilidad con firmware 1.x Esta versión actualiza el envoltorio para alinearse...

Lastenzug

LastenZug Este proyecto implementa un proxy Socka4a basado en websockets. El componente cliente está implementado en C y se compila hasta convertirse en código totalmente independiente de posición PIC. Durante el proceso de compilación, se aplica ofuscación a nivel de ensamblador mediante una...

ExternalC2

ExternalC2 Una librería para integrar canales de comunicación con el servidor External C2 de Cobalt Strike Esta librería proporciona una implementación de la especificación External C2 de Cobalt Strike, incluyendo un canal web básico y un canal websocket. La base de código ha sido documentada y...

cookie_crimes

Chrome Cookie Extraction Without Root This will print out a user's Chrome cookies. You don't need to have their password or be root to use it. nice nice nice nice nice. If you are not the kind of person who regularly gets the ability to execute code on other people's computers, you probably don't...

Lastenzug

LastenZug Este proyecto implementa un proxy Socka4a basado en websockets. El componente cliente está implementado en C y se compila como código totalmente independiente de posición PIC. Durante el proceso de compilación, se aplica ofuscación a nivel de ensamblador mediante una segunda herramienta...

reinschauer

Reinschauer Un PoC para controlar remotamente máquinas Windows a través de Websockets. Echa un vistazo a mi blog para un análisis detallado. Se puede ejecutar como exe de Go, exe de .NET/C y en memoria usando BOF.NET y Cobaltstrike. El tráfico se puede tunelizar a través de una conexión Beacon...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-62247

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247 Supabase Realtime: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

EUVD-2026-84066

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-62247: Incorrect Authorization

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied...

CVE-2026-87742

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...

CVE-2026-87742

A flaw in quarkus-websockets-next allows a remote attacker to trigger a Denial of Service by streaming messages over a single connection faster than the application can process them. The root cause is unbounded message buffering combined with a lack of read backpressure , which rapidly exhausts h...

CVE-2026-87742 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service DoS by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly...